9.6.0-alpha.3

9.6.0-alpha.3 (2026-03-09)

Bug Fixes

• SQL injection via Increment operation on nested object field in PostgreSQL (GHSA-q3vj-96h2-gwvg) (#10161) (8f82282)

9.6.0-alpha.2

9.6.0-alpha.2 (2026-03-09)

Bug Fixes

• SQL injection via dot-notation field name in PostgreSQL (GHSA-qpr4-jrj4-6f27) (#10159) (ea538a4)

9.6.0-alpha.1

9.6.0-alpha.1 (2026-03-09)

Features

• Add X-Content-Type-Options: nosniff header and customizable response headers for files via Parse.Cloud.afterFind(Parse.File) (#10158) (28d11a3)

9.5.2-alpha.14

9.5.2-alpha.14 (2026-03-09)

Bug Fixes

• LiveQuery regexTimeout default value not applied (#10156) (416cfbc)

9.5.2-alpha.13

9.5.2-alpha.13 (2026-03-09)

Bug Fixes

• LDAP injection via unsanitized user input in DN and group filter construction (GHSA-7m6r-fhh7-r47c) (#10154) (5bbca7b)

9.5.2-alpha.12

9.5.2-alpha.12 (2026-03-09)

Bug Fixes

• Classes _GraphQLConfig and _Audience master key bypass via generic class routes (GHSA-7xg7-rqf6-pw6c) (#10151) (1de4e43)

9.5.2-alpha.11

9.5.2-alpha.11 (2026-03-09)

Bug Fixes

• Concurrent signup with same authentication creates duplicate users (#10149) (853bfe1)

Warning

Parse Server now automatically creates unique indexes on authData fields for each configured authentication provider on startup, including anonymous when anonymous users are enabled. These indexes prevent concurrent signups from creating duplicate user accounts with the same authentication identity. If the indexes already exist, no action is taken. Without these indexes, concurrent signup requests with the same authData can bypass the application-level uniqueness check and create duplicate user accounts, which prevents subsequent login for the affected accounts. To skip automatic index creation, set the createIndexAuthDataUniqueness database option to false. If duplicate authData entries already exist in the database, a warning is logged at startup and the index is not created; the duplicates need to be resolved manually before the index can be created.

8.6.29

8.6.29 (2026-03-09)

Bug Fixes

• SQL injection via Increment operation on nested object field in PostgreSQL (GHSA-q3vj-96h2-gwvg) (#10163) (c92022f)

8.6.28

8.6.28 (2026-03-09)

Bug Fixes

• SQL injection via dot-notation field name in PostgreSQL (GHSA-qpr4-jrj4-6f27) (#10160) (83f38fa)

8.6.27

8.6.27 (2026-03-09)

Bug Fixes

• LiveQuery regexTimeout default value not applied (#10157) (94c4f52)